What the programs
are doing
National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program led with 48 accepted findings, 12 programs opened up, 10 went quiet.
The window changes Active now, New, Quiet and Movers. Money, targets, severity and researchers are marked whole corpus and do not change with it, because a single week has too few events for those sections.
Programs accepting the most findings
These programs accepted the most findings in the last 7 days. Two columns help tell a busy program from a crowded one: how many different people had findings accepted, and whether the platform showed a payout on any of them.
| Program | Accepted | Finders | Crit/high | Paid | Last seen |
|---|---|---|---|---|---|
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 48 | 31 +4 withheld | 16 | not set | yesterday |
| ClickHouse | 20 | 7 +4 withheld | 1 | not set | yesterday |
| State of California VDP | 16 | 7 +3 withheld | 8 | not set | today |
| Atlassian | 14 | 6 +5 withheld | 7 | $16,250 | yesterday |
| Mattermost Public Bug Bounty Engagement | 12 | 6 +1 withheld | not set | $1,950 | yesterday |
| Bitdefender | 10 | 7 +3 withheld | 3 | $4,500 | 3 days ago |
| Settle Vulnerability Disclosure Program | 10 | 6 +1 withheld | 2 | not set | 3 days ago |
| Savignano Software Solutions Marketplace Bug Bounty Program | 8 | 2 +2 withheld | not set | $2,100 | 2 days ago |
| eToro Managed Bug Bounty Engagement | 7 | 7 | 6 | $15,000 | yesterday |
| Mastercard Public Bug Bounty | 7 | 6 +1 withheld | 1 | $880 | yesterday |
| Indeed | 7 | 3 +4 withheld | 3 | $10,800 | yesterday |
| U.S. Department of Commerce - Vulnerability Disclosure Program | 7 | 3 | not set | not set | yesterday |
What findings have paid whole corpus
Every figure here comes from amounts a platform published, in US dollars only, since that is the one currency with enough rows to add up. A single week has only a handful of published awards, so this section covers everything on file. The window setting does not change it.
Published amounts are rare. Bugcrowd seldom publishes one, and HackerOne shows one only on the minority of reports that both sides later disclosed. These 1,879 awards are the ones that happened to be published, out of 8,588 events, so every total here is a floor. A program with no amount shown may still pay well.
How large the shown awards were
- under $250 485 26%
- $250–999 792 42%
- $1k–5k 453 24%
- $5k–10k 72 4%
- $10k and up 77 4%
What a shown award was worth, by severity
This is the spread of amounts for findings at each severity that were paid and had the amount published. Findings with no published amount are left out, so this does not show what a severity pays in general.
| Severity | Awards shown | Low | Typical | High | Total |
|---|---|---|---|---|---|
| Critical | 254 | $300 | $7,780 | $133,700 | $1,976,131 |
| High | 330 | $100 | $3,153 | $80,000 | $1,040,475 |
| Medium | 744 | $50 | $613 | $10,000 | $456,428 |
| Low | 529 | $20 | $192 | $1,000 | $101,449 |
| None | 9 | $25 | $147 | $500 | $1,325 |
| Unrated | 13 | $100 | $2,856 | $12,500 | $37,134 |
How the platforms differ in what they show
| Platform | Accepted | Amounts shown | Disclosed | Total shown |
|---|---|---|---|---|
| bugcrowd | 7,486 | 1,802 (24%) | 595 | $3,467,332 |
| hackerone | 682 | 76 (11%) | 682 | $145,460 |
The gap between "accepted" and "amounts shown" mostly reflects what each platform publishes. It does not show how generous programs are. HackerOne rows exist only because a report was disclosed, so its "disclosed" count always equals its accepted count. Bugcrowd discloses some of its acceptances and publishes an amount on fewer still.
Programs with published payouts
These programs have at least one published award, with the highest total paid first. "Shown" is how many of their acceptances had a published amount. A low share next to a high acceptance count means the program rarely publishes amounts. It does not mean it rarely pays.
| Program | Accepted | Shown | Largest | Total shown |
|---|---|---|---|---|
| T-Mobile | 158 | 35 (22%) | $133,700 | $1,034,100 |
| Atlassian | 460 | 138 (30%) | $30,000 | $266,150 |
| City of Vienna Managed Bug Bounty | 203 | 129 (64%) | $3,500 | $158,925 |
| OpenSea Managed Bug Bounty Program | 87 | 43 (49%) | $50,000 | $157,750 |
| Auth0 by Okta | 47 | 22 (47%) | $50,000 | $116,150 |
| Indeed | 211 | 86 (41%) | $10,000 | $91,950 |
| Fireblocks MPC Managed Bug Bounty Engagement | 19 | 7 (37%) | $80,000 | $91,950 |
| Tesla | 110 | 48 (44%) | $10,000 | $89,511 |
| Bitdefender | 105 | 41 (39%) | $10,000 | $70,400 |
| Keeper Security Public Bounty Program | 124 | 27 (22%) | $11,000 | $66,700 |
The largest single awards on file
Open any of these to see the full record: the asset, who found it, its current state, and whether an award this size is normal for that program.
-
T-Mobile $133,700 critical
-
T-Mobile $133,700 critical
-
T-Mobile $133,700 critical
-
Fireblocks MPC Managed Bug Bounty Engagement $80,000 high
-
T-Mobile $55,000 critical
-
T-Mobile $55,000 critical
-
Auth0 by Okta $50,000 critical
-
Auth0 by Okta $50,000 critical
Which assets are producing findings whole corpus
This table lists the specific assets with accepted findings, and how serious those findings were. It is the most detailed data on the site, and nobody else publishes it. An asset that keeps producing criticals is a very different prospect from one that only produces lows.
Only Bugcrowd names the asset in this data. HackerOne's disclosed reports do not, so HackerOne programs are missing from this table. Their absence does not mean they are under-hunted. We also do not match these assets against scope lists. Our scope data comes from HackerOne and these assets come from Bugcrowd, so the two never line up, and a loose match between them would give results we could not trust.
| Asset | Accepted | Finders | Crit | Crit/high | Last seen |
|---|---|---|---|---|---|
| https://nasa.gov | 571 | 333 +75 withheld | 121 | 156 | yesterday |
| https://github.com/ClickHouse/ClickHouse | 343 | 93 +106 withheld | 1 | 31 | yesterday |
| Public Others Target | 143 | 32 +77 withheld | 9 | 26 | yesterday |
| *.wien.gv.at | 114 | 35 +20 withheld | 37 | 51 | yesterday |
| *.ca.gov | 92 | 20 +50 withheld | 12 | 24 | today |
| *.indeed.com | 91 | 29 +45 withheld | 4 | 7 | yesterday |
| Petpooja Production Web Applications & APIs | 67 | 26 +7 withheld | 5 | 24 | 17 days ago |
| https://bugcrowd-*your-own-instance*.cloud.mattermost.com/ | 62 | 21 +10 withheld | 0 | 3 | 2 days ago |
| Confluence Data Center | 58 | 15 +41 withheld | 1 | 18 | 9 days ago |
| *.tesla.com | 58 | 24 +18 withheld | 6 | 14 | 11 days ago |
| *.meraki.com | 56 | 20 +23 withheld | 4 | 8 | 3 days ago |
| *.t-mobile.com | 53 | 17 +25 withheld | 14 | 30 | 4 days ago |
Programs accepting critical and high findings whole corpus
This shows which programs have accepted critical and high findings. If a program has never accepted anything above medium, that tells you what kind of work it rewards. One that accepts criticals is worth a closer look, whatever its volume.
| Program | Critical | High | Accepted | Finders |
|---|---|---|---|---|
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 139 | 52 | 689 | 401 |
| T-Mobile | 52 | 56 | 158 | 43 |
| City of Vienna Managed Bug Bounty | 52 | 28 | 203 | 55 |
| Monash University Bug Bounty | 31 | 7 | 79 | 27 |
| State of Maryland Vulnerability Disclosure Program | 27 | 16 | 84 | 31 |
| Thales Cyber Security Products Bug Bounty | 25 | 9 | 74 | 9 |
| Comcast Xfinity Vulnerability Disclosure Program | 25 | 9 | 71 | 8 |
| Comcast Xfinity Bug Bounty | 24 | 7 | 100 | 31 |
| US Environmental Protection Agency Vulnerability Disclosure | 24 | 2 | 53 | 17 |
| Atlassian | 23 | 97 | 460 | 111 |
| United Airlines | 21 | 18 | 91 | 20 |
| Opera Public Bug Bounty | 16 | 22 | 108 | 51 |
Severity is the platform's own label. About one event in fourteen has no severity. Those events are left out of this table. We do not assume they were harmless.
How many people get findings accepted whole corpus
If a dozen different people are getting findings accepted on a program, a newcomer has a fair chance there. If one finder holds most of the accepted work, that person may be farming the program, or it may have one very productive specialist. We show the numbers and leave the judgement to you.
| Program | Finders | Accepted | Most by one finder |
|---|---|---|---|
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 401 | 689 | 3% |
| ClickHouse | 118 | 430 | 7% |
| Atlassian | 111 | 460 | 12% |
| Indeed | 74 | 211 | 6% |
| City of Vienna Managed Bug Bounty | 55 | 203 | 14% |
| Opera Public Bug Bounty | 51 | 108 | 14% |
| Tesla | 50 | 110 | 10% |
| Nextcloud | 47 | 75 | 9% |
| 46 | 112 | 10% | |
| Mattermost Public Bug Bounty Engagement | 45 | 132 | 28% |
| T-Mobile | 43 | 158 | 8% |
| Bitdefender | 42 | 105 | 16% |
The share is the busiest named finder's events as a fraction of named events only. A withheld name could belong to anyone, so withheld events do not count toward the figure. Where many names are withheld, the row says so and the share is a floor.
What just opened
Our directory sync spotted these programs launching, starting to pay bounties, or reopening submissions. A program in its first weeks has the shortest queue it will ever have.
-
Kiwa Reopened submissions
No accepted findings in our sample yet.
-
Dstny Reopened submissions
No accepted findings in our sample yet. Pays up to $1,500.
-
Attentia VDP Reopened submissions
No accepted findings in our sample yet.
-
Here Technologies Reopened submissions
No accepted findings in our sample yet. Pays up to $2,000.
-
WP Engine Reopened submissions
No accepted findings in our sample yet. Pays up to $2,500.
-
Lightspark Reopened submissions
No accepted findings in our sample yet. Pays up to $5,000.
-
Rivian Launched
No accepted findings in our sample yet.
-
Kahoot Reopened submissions
No accepted findings in our sample yet. Pays up to $5,000.
-
Lightspark Reopened submissions
No accepted findings in our sample yet. Pays up to $5,000.
-
Telenet - Base - Wyre - Tadaam Reopened submissions
No accepted findings in our sample yet. Pays up to $2,000.
-
Here Technologies Reopened submissions
No accepted findings in our sample yet. Pays up to $2,000.
-
Bytera Marketplace Managed Bug Bounty Engagement Launched
2 accepted findings since. Pays up to $1,500.
Programs that have gone quiet
There are two lists here, kept separate because the evidence behind them differs in strength. The first is programs whose output fell. They used to produce findings and have slowed down. The second is live, bounty-paying programs where we have seen nothing at all.
A quiet program may be an opportunity, but there is no guarantee. Quiet has at least three causes we cannot tell apart from here. The program may be under-hunted. It may be hard, or so narrow in scope that there is little to find. Or earlier hunters may have already taken the easy findings. Silence can also mean the platform stopped publishing the program's activity. For HackerOne rows, this measures how often the program discloses, which is mostly a policy choice. Use this as a shortlist to look into, and read the scope before you read anything into the number.
Output has dropped
-
Petpooja Vulnerability Disclosure Program
84 events on record from 30 named finders over 48 days. At that rate you would expect about 24.5 in the last 14 days, and it had none. The last one was 17 days ago.
-
HSBC Vulnerability Disclosure Program
35 events on record from 7 named finders over 28 days. At that rate you would expect about 17.5 in the last 14 days, and it had 4. The last one was 3 days ago.
-
MariaDB
32 events on record from 18 named finders over 39 days. At that rate you would expect about 11.5 in the last 14 days, and it had none. The last one was 25 days ago.
-
Comcast Xfinity Bug Bounty Pays
100 events on record from 31 named finders over 135 days. At that rate you would expect about 10.4 in the last 14 days, and it had none. The last one was 3 months ago.
-
New Balance VDP
41 events on record from 3 named finders over 70 days. At that rate you would expect about 8.2 in the last 14 days, and it had none. The last one was 16 days ago.
-
Keeper Security Public Bounty Program Pays
124 events on record from 39 named finders over 180 days. At that rate you would expect about 9.6 in the last 14 days, and it had 2. The last one was yesterday.
-
Comcast Xfinity Vulnerability Disclosure Program
71 events on record from 8 named finders over 159 days. At that rate you would expect about 6.3 in the last 14 days, and it had none. The last one was 2 months ago.
-
Centers for Medicare & Medicaid Services - Public Bug Bounty Program 2026 Pays
42 events on record from 10 named finders over 119 days. At that rate you would expect about 4.9 in the last 14 days, and it had none. The last one was 2 months ago.
-
Home Depot Vulnerability Disclosure Engagement
20 events on record from 10 named finders over 44 days. At that rate you would expect about 6.4 in the last 14 days, and it had 2. The last one was 9 days ago.
-
Gearset: Managed Bug Bounty Pays
90 events on record from 24 named finders over 238 days. At that rate you would expect about 5.3 in the last 14 days, and it had 1. The last one was yesterday.
Live, paying, nothing seen
These programs are open and pay bounties, but we have seen nothing from them for 14 days. The platform may not publish this program's activity at all. Check before you treat it as an opening.
-
Swiss Post - E-Voting
Nothing on record at all. Pays up to $230,000.
-
Intel®
Nothing on record at all. Pays up to $100,000.
-
SpaceX/Starlink
5 events on record, none recently. Pays up to $100,000.
-
Okta
31 events on record, none recently. Pays up to $75,000.
-
Capture Our Flag
Nothing on record at all. Pays up to $51,337.
-
Auth0 by Okta
47 events on record, none recently. Pays up to $50,000.
-
Doctolib
Nothing on record at all. Pays up to $50,000.
-
Kiteworks
Nothing on record at all. Pays up to $50,000.
-
Zendesk Managed Bug Bounty Engagement
Nothing on record at all. Pays up to $50,000.
-
Altera
Nothing on record at all. Pays up to $30,000.
What changed pace
This compares the last 7 days with the 7 before them, for programs with enough events for a change to mean anything.
Rising
-
Mattermost Public Bug Bounty Engagement
+12, 0 to 12 (no prior activity on record)
-
National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
+12, 36 to 48 (33%)
-
Savignano Software Solutions Marketplace Bug Bounty Program
+8, 0 to 8 (no prior activity on record)
-
eToro Managed Bug Bounty Engagement
+7, 0 to 7 (no prior activity on record)
-
U.S. Department of Commerce - Vulnerability Disclosure Program
+6, 1 to 7 (600%)
-
Bitdefender
+5, 5 to 10 (100%)
Falling
-
Settle Vulnerability Disclosure Program
-26, 36 to 10 (-72%)
-
New Relic Public Bug Bounty Program
-22, 22 to 0 (-100%)
-
ClickHouse
-16, 36 to 20 (-44%)
-
curl
-13, 13 to 0 (-100%)
-
Nextcloud
-11, 11 to 0 (-100%)
-
City of Vienna Managed Bug Bounty
-10, 12 to 2 (-83%)
This page is built from public feeds. Two scheduled jobs read Bugcrowd's CrowdStream and HackerOne's disclosed reports a few pages at a time, and store one row per published event. This page has no report titles and no vulnerability details. The feeds do not include them, and we do not look for them elsewhere. Where a platform withheld the finder's name, we record it as withheld and leave it that way. Counts are a floor on activity. A program can be busy and publish nothing. We only show an amount when a platform published it first. Last ingest today.